Privacy Notice

1. Introduction

Pelli Entertainment, LLC (“Pelli,” “we,” “us,” or “our”) respects your privacy and is committed to protecting your personal information. This Privacy Notice describes how we collect, use, disclose, retain, and protect information about you when you use the Pelli mobile application and website (collectively, the “Services”).

By using the Services, you acknowledge and agree to the terms of this Privacy Notice and any updates that may be posted from time to time.

2. Scope of This Notice

This Notice applies to all users of the Pelli Services, including individuals located in the United States, California, Canada, and the European Union. It governs all personal information collected, processed, and stored by Pelli Entertainment, LLC in connection with the operation of its Services.

3. Information We Collect

We collect personal information that you voluntarily provide, information automatically collected through your device, and limited information from authorized third parties.

a. Information You Provide Directly

• Account Information: Email address, password, account type (fan, artist, or venue), display name, and related profile data.
• Profile Content: Photos, event listings, venue or artist images, and other content voluntarily uploaded.
• Preferences: Genre selections, event preferences, and related settings used to personalize search and discovery features.
• Payment Information: Subscription or purchase information processed through third-party payment providers (e.g., Stripe). Pelli does not store or process complete payment card details on its servers.
• Communications: Information you provide when contacting us or using in-app communication tools.

b. Information Collected Automatically

• Device and Usage Data: Device identifiers, operating system, and access time.
• Location Data: Approximate or precise location derived from your device's GPS when you enable location services. This is used to display nearby events and location-based search results. You may disable location access at any time in your device settings or within the app, although certain features — such as proximity-based event discovery and check-ins — will be unavailable without it.
• Camera and Media Access: The app requests access to your device's camera and photo library solely to allow you to upload images for your account avatar, event listings, or venue/artist profiles. Pelli does not capture or record images without your explicit action.

c. Information from Third Parties

We may receive limited personal information from:

• Authentication Providers: Google and Apple (via OAuth), for account creation and sign-in.
• Payment Processors: Stripe, for confirmation of successful transactions.

4. How We Use Personal Information

We process personal data for the following purposes:

• To create and maintain user accounts.
• To provide, operate, and improve the Services.
• To personalize content and search results based on user preferences.
• To provide location-based event discovery features where you have enabled location access.
• To process subscription payments through third-party processors.
• To send in-app notifications about events or account activity consistent with your preferences and notification settings.
• To ensure security, prevent fraud, and comply with legal obligations.
• To perform analytics and improve system performance using aggregated, anonymized data.

5. Legal Bases for Processing (GDPR and PIPEDA)

For users located in the European Union and Canada, we rely on the following legal bases:

• Performance of a Contract: To provide and manage your account and deliver the requested Services, including core features that do not require location access.
• Legitimate Interests: To secure our systems and detect and prevent fraud, and to analyze usage patterns and improve application functionality, where these interests are not overridden by your data protection rights.
• Consent: When you choose to enable location or camera access, or when you opt in to receive in-app notifications. Location data is used to enable optional features — such as proximity-based event discovery, check-ins, and nearby artist alerts — that are not required to use the core search functionality of the Services. You may withdraw consent at any time without affecting your ability to use the core Services.
• Legal Obligation: To comply with applicable laws and enforce our Terms of Use.

Pelli has appointed a Data Protection Officer (DPO). For data protection inquiries, the DPO may be contacted via the contact form at pelliapp.com/contact.

6. Sharing and Disclosure of Information

We may share personal information only in the following circumstances:

• Service Providers: With vendors such as Supabase (data hosting), Stripe (payment processing), Postmark (transactional emails), and Formspree (contact form submission processing), each acting under written agreements that require protection of personal data.
• Legal Requirements: When necessary to comply with applicable law, court order, or lawful government request.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, provided equivalent privacy protections remain in place.

We do not sell personal data to third parties.

7. Data Retention

Pelli retains personal data only for as long as necessary to provide the Services, fulfill a legitimate business purpose, or as required by law. The following retention periods apply:

• Active Account Data: Retained for the duration of your account. Upon account deletion, all personally identifiable information is immediately and permanently overwritten or destroyed.
• Behavioral and Preference Data: Upon account deletion, behavioral and preference data (such as saved events, check-ins, liked artists, liked venues, and genre preferences) is anonymized. After one (1) year it may be aggregated with other data or destroyed. The link between these records and your identity is permanently severed at the time of account deletion.
• Financial and Subscription Records: Subscription and billing records are retained in anonymized form for up to seven (7) years following account deletion to satisfy legal and financial compliance obligations. These records are not linked to your identity.
• Security and Audit Logs: System logs that may contain limited identifiers (e.g., account ID) are retained for up to one (1) year for security and auditing purposes.
• Age Attestation Records: Age attestation records are retained as non-personal operational data. The link between these records and any individual is permanently and irreversibly severed upon account deletion.
• Backup Data: Recovery backups are retained for approximately seven (7) days, after which they are destroyed. Backup data is not actively queried or processed for any purpose related to a deleted user.
• Aggregated Analytics: Anonymized aggregate data may be retained indefinitely for statistical purposes.

Upon account deletion, all data that is traceable to you (other than anonymized financial transaction records retained for legal compliance) is immediately and irrevocably destroyed.

8. International Data Transfers

All personal information collected by Pelli is processed and stored in the United States. For users in the EU, UK, or Canada, data transfers are conducted under appropriate legal safeguards, including Standard Contractual Clauses (SCCs) where applicable. By using the Services, you acknowledge that your information will be transferred to the United States for processing in accordance with this Notice.

9. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights with respect to your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete personal data.
• Deletion / Erasure: Request deletion of your personal data, subject to applicable legal retention obligations. See Section 10 for full details on how to exercise this right.
• Withdrawal of Consent: Withdraw consent where processing is based on consent, without affecting the lawfulness of prior processing. You may withdraw consent for location access at any time through your device settings or within the app. You may withdraw consent for in-app notifications at any time through the Profile Settings toggle within the app, or through your device's notification settings.
• Objection and Restriction: Object to or request restriction of certain processing activities.
• Portability: Request that certain personal data be provided to you in a structured, machine-readable format.

If you are located in the European Union, you also have the right to lodge a complaint with the data protection supervisory authority in your country of residence if you believe we have processed your personal data in a manner inconsistent with applicable data protection law.

To exercise any of these rights, please use the methods described in Section 10 below. We will respond to verifiable requests within 30 calendar days. In cases of complexity or volume, we may extend this period by an additional 30 days, provided we notify you within the initial 30-day window.

a. Additional Rights for California Residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with additional rights regarding your personal information.

Categories of Personal Information Collected

The table below identifies the categories of personal information Pelli collects, as defined under the CCPA/CPRA, together with the applicable retention period for each category.

Sensitive Personal Information (SPI) — Geolocation

Precise geolocation is classified as Sensitive Personal Information under the CPRA. Pelli uses geolocation solely to provide optional location-based features — specifically, proximity-based event discovery, check-ins at events, and nearby artist alerts. Geolocation is never used for advertising, profiling, or any purpose beyond these features. You may opt out of geolocation collection at any time through your device settings or within the app. Opting out does not affect your ability to use Pelli's core search functionality.

Do Not Sell or Share My Personal Information

Pelli does not sell your personal information to third parties. Pelli does not share your personal information for cross-context behavioral advertising. Our third-party service providers (Supabase, Stripe, Postmark, and Formspree) receive personal information only as necessary to provide their respective services to Pelli and are contractually prohibited from using that information for their own marketing or advertising purposes.

Shine the Light Disclosure (California Civil Code § 1798.83)

Pelli does not disclose personal information to third parties for those third parties' own direct marketing purposes. California residents may request information about any such disclosures by contacting us via pelliapp.com/contact, though no such disclosures occur.

Financial Incentives

Pelli does not offer financial incentives, discounts, or different levels of service in exchange for the collection, retention, or sale of personal information. Subscription tiers, where applicable, are not conditioned on providing additional personal data.

How to Exercise Your California Privacy Rights

California residents may submit requests to access, correct, delete, or limit the use of their personal information using the methods described in Section 10. We will respond to verified requests within 45 calendar days, consistent with CCPA/CPRA requirements.

10. Account Deletion and Data Deletion Requests

Pelli provides two ways to delete or request deletion of your account and associated personal data, in compliance with Apple App Store Review Guideline 5.1.1(v), Google Play's data deletion requirements, GDPR Article 17 (Right to Erasure), and the CCPA/CPRA Right to Delete.

a. In-App Account Deletion (Primary Method)

You may delete your account directly within the Pelli app at any time:

• From the authenticated landing page, tap the Profile Settings icon in the footer, then tap Account Preferences (the gear icon).
• Select “Delete Account” at the bottom of the Account Preferences screen.
• Review the confirmation screens, which clearly state that account deletion is permanent and cannot be undone. Details of what is deleted, anonymized, and retained are described in Section 10c of this Privacy Notice.
• Confirm the deletion request.
• Upon confirming deletion, an in-app notification will confirm your request has been received. A confirmation email will be sent to your registered email address once your data has been removed.

b. Web-Based Deletion Request (For Users Without App Access)

If you no longer have access to the app or have already uninstalled it, you may submit a data deletion request through our website. This ensures you can exercise your right to deletion regardless of whether you still have the app installed, consistent with Google Play's data deletion policy.

Submit your request at: https://pelliapp.com/contact

Please include the following in your request:

• The email address associated with your Pelli account.
• A clear statement that you are requesting account and data deletion.
• Any additional information needed to verify your identity.

We will verify your identity via email before processing the request. Verified requests will be processed within 30 calendar days.

c. What Happens When You Delete Your Account

Upon account deletion:

• Immediately deleted: Your authentication credentials, push notification tokens, profile image, and uploaded identity documents are permanently deleted.
• Anonymized: Behavioral data such as saved events, liked artists, liked venues, check-in records, artist/venue membership records, and genre preferences are anonymized. Any artist or venue profile memberships associated with your account are removed as part of the deletion process.
• Retained for legal compliance: Financial and subscription records are retained in anonymized form for up to 7 years as required by law. Age attestation records are retained as non-personal operational data; the link to your identity is permanently severed upon account deletion. These records contain no information that can reasonably identify you.

Once anonymization and deletion are complete, the connection between your identity and any retained records is permanently and irreversibly destroyed.

11. Children's Privacy

Pelli is intended for use by individuals aged 16 or older. We do not knowingly collect or process personal data from children under the age of 13 in the United States or under the age of 16 in the European Union. Users must affirm their age eligibility at registration. If we learn that a minor has registered, we will promptly delete the associated account and data.

12. Security of Information

We implement reasonable technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, or destruction. These measures include encryption, access controls, and secure data hosting through reputable providers. No system is completely secure, and users acknowledge this risk when transmitting information over the Internet.

13. Third-Party Links and Integrations

The Services may contain links to third-party websites or integrations (e.g., Google, Apple, etc.). Pelli is not responsible for the privacy practices of these third parties. Users are encouraged to review the privacy policies of any linked sites before providing personal information.

14. Changes to This Privacy Notice

We may update this Privacy Notice periodically to reflect changes in our practices or applicable law. The updated version will include a new “Last Updated” date. Material changes will be communicated through in-app notifications or other reasonable means. Continued use of the Services after such updates constitutes acceptance of the revised Notice.

15. Contact Information

For questions or concerns about this Privacy Notice or our privacy practices, including data protection inquiries directed to our Data Protection Officer, please use the contact page on the Pelli website at https://pelliapp.com/contact.